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DETAILED ACTION 
Response to Amendments 

1 . This action is in reply to the response filed on May 5, 2009. 

2. Acknowledgement is made that the applicant has amended claims 1, and 13; cancelled claims 5- 
7 and added new claim 15. 

3. Claims 1, 3, 4, and 8-15 are currently pending and have been examined. 

4. The rejections of claims 1, 3, 4, and 8-15 have been updated to reflect the amendments. 

5. The Examiner has carefully reviewed the Applicant's response and has determined that the 
rejection stands and is resubmitted below addressing the claims as modified by said 
amendments. 

Information Disclosure Statement 

6. The Information Disclosure Statements filed on July 10, 2009, and April 23, 2009 has been 
considered. An initialed copy of the Form 1449 is enclosed herewith. 

Claim Rejections - 35 USC § 103 

7. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all obviousness 
rejections set forth in this Office action: 

A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be 
patented and the prior art are such that the subject matter as a whole would have been obvious 
at the time the invention was made to a person having ordinary skill in the art to which said 
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subject matter pertains. Patentability shall not be negatived by the manner in which the invention 
was made. 



8. The factual inquiries set forth in Graham v. John Deere Co., 383 U.S. 1, 148 USPQ 459 (1966), 
that are applied for establishing a background for determining obviousness under 35 
U.S.C. 103(a) are summarized as follows: 

(a) Determining the scope and contents of the prior art. 

(b) Ascertaining the differences between the prior art and the claims at issue. 

(c) Resolving the level of ordinary skill in the pertinent art. 

(d) Considering objective evidence present in the application indicating obviousness or 
nonobviousness. 



9. Claims 1, 3, 8-13, and 15 are rejected under 35 USC 103(a) as being unpatentable over Blocher 
et al., US Patent Application No US 2002/0194059 A1, in view of The Internal Auditor, 
Segregation of duties in ERP, October 2003., Vol. 60, Iss. 5, pg. 27, Susan S. Lightle, Cynthia 
Waller Valrio; herein referred to as "Lightle". 



10. With respect to Claims 1 3 and 1 5, 

Blocher discloses the following limitations, 

• a storage component configured to store: (see at least Figure 1, paragraph 47: "...The 
computer system 10 generally comprises memory 12, input/output interfaces 14, a central 
processing unit (CPU) 16, external devices/resources 18, bus 20, and database 32. Memory 
12 may comprise any known type of data storage and/or transmission media, including 
magnetic media, optical media, random access memory (RAM), read-only memory (ROM), a 
data cache, a data object, etc. Moreover, memory 12 may reside at a single physical location, 
comprising one or more types of data storage, or be distributed across a plurality of physical 
systems in various forms...") 
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• a business process library comprising a plurality of business processes, each business 
process including one or more business functions,; (see at least Figures 1-7, paragraph 49: 
"...Stored in memory 12 is review system 22 (shown in FIG. 1 as a software product). Review 
system 22... generally comprises an interface 24 for inputting business process and/or 
control point information, and templates 26 for arranging the inputted information in a 
standard format. Database 32 provides storage for arranged templates 26. Information 
arranged in a template could include, inter alia: (1) a business process; (2) a set of tests 
designed to identify risks in the business process; and (3) a set of actions designed to 
address the identified risks. In addition, once stored in database 32, reviewers and/or 
auditors 34 could access templates 26. Database 32 may comprise one or more storage 
devices, such as a magnetic disk drive or an optical disk drive...."; paragraph 50: 
"...Templates 26 are forms that allow all pertinent business process and/or control point 
information to be arranged in a standard format and stored so that reviewers 28 and/or 
auditors 34 can efficiently and accurately access the same..."; paragraph 59: "...each time a 
new business process is created or an existing business process is modified, a new review is 
conducted and information is arranged in a template. It should be appreciated that the 
template shown in FIGS. 2-7 is preferably completed as an electronic document on the 
computer system via the interface. ..."; paragraph 54: "...the business process of paying an 
invoice could includes the following steps: (1) an invoice is received; (2) the invoice is 
forwarded to accounts payable; (3) payment is approved; (4) a check ordered; and (5) the 
check is signed and sent out. It should be understood, however, that this example is 
illustrative and not intended to be limiting. For example, the set of steps could include any 
quantity of steps. In addition, the business process is preferably provided in the form of a 
framework such as a list, design flow chart, or the like...") 

• a sef of business processes specific to an enterprise; (see at least paragraph 36: ..." 
Business Process-a set of steps followed to perform a business function...."; paragraph 55: 
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"...Once the process is provided, any risks therein should be identified. Each identified risk 
represents a control point that should be addressed..."; paragraph 56: "...The set of tests and 
set of actions comprise control point information. Along with other pertinent information, this 
information is arranged in a template 26 and stored in database 32...") 

• the set of business processes representing a subset of the plurality of business processes in 
the business process library (see at leastparagraph 54: "...the business process of paying an 
invoice could includes the following steps: (1) an invoice is received; (2) the invoice is 
forwarded to accounts payable; (3) payment is approved; (4) a check ordered; and (5) the 
check is signed and sent out. It should be understood, however, that this example is 
illustrative and not intended to be limiting. For example, the set of steps could include any 
quantity of steps. In addition, the business process is preferably provided in the form of a 
framework such as a list, design flow chart, or the like...") 

• at least one processing component in communication with the storage component, (see at 
least Figure 1, paragraph 47: "...The computer system 10 generally comprises memory 12, 
input/output interfaces 14, a central processing unit (CPU) 16, external devices/resources 18, 
bus 20, and database 32. Memory 12 may comprise any known type of data storage and/or 
transmission media, including magnetic media, optical media, random access memory 
(RAM), read-only memory (ROM), a data cache, a data object, etc. Moreover, memory 12 
may reside at a single physical location, comprising one or more types of data storage, or be 
distributed across a plurality of physical systems in various forms. CPU 16 may likewise 
comprise a single processing unit, or be distributed across one or more processing units in 
one or more locations, e.g., on a client and server..." ; paragraph 49: "...Database 32 
provides storage for arranged templates 26. Information arranged in a template could include, 
inter alia: (1) a business process; (2) a set of tests designed to identify risks in the business 
process; and (3) a set of actions designed to address the identified risks. In addition, once 
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stored in database 32, reviewers and/or auditors 34 could access templates 26..."; paragraph 
52: "...Computer program, software program, program, or software, in the present context 
mean any expression, in any language, code or notation, of a set of instructions intended to 
cause a system having an information processing capability to perform a particular function 
either directly or after either or both of the following: (a) conversion to another language, code 
or notation; and/or (b) reproduction in a different material form...") 



Blocher discloses all of the limitations described above; Lightle discloses the following limitations, 

• each business function being associated with a list of one or more other business functions 
that are incompatible with said each business function 

• a business function compatibility registry specific to the enterprise that includes a set of 
business function incompatibilities, each business function incompatibility identifying at least 
two business functions that should not be simultaneously assigned to a single employee of 
the enterprise; (see at least page 3, paragraph 15: "...in an enterprise resource planning 
environment, tasks are linked electronically as part of the integration of all aspects of the 
organization's business information processing..."; page 2, paragraph 7: "...the consultants 
provided their own proprietary SOD analysis too..."; paragraph 8: "...the tool contained a 
matrix showing tasks that should not be combined. ..adding some conflicts and deleting others 
based on Mead's control philosophy and business process design...") 



• at least one processing component being configured to: 

• receive, from an auditor, a selection of a business process from the business process library 
for inclusion in the set of business processes; 

• add a business function included in the selected business process and its associated list of 
incompatible business functions to the business function compatibility registry. 

(see at least page 2, paragraph 8: "...the tool contained a matrix showing tasks that should not be 
combined... the internal audit staff, with the help of the consultant, customized the software's 
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matrix, adding some conflicts and deleting others..."; paragraph 10: "...the internal audit team 
reviewed the list and assessed each item..."; paragraph 11: "...they continue to refine the matrix 
of SOD conflicts ...the development of the matrix of SOD conflicts is an ongoing audit 
operation...."; paragraph 12: "...as tasks evolve and employees come and go, transaction codes 
may be added and deleted, and user profiles may be created or changed, potentially introducing 
new conflicts. Mead's auditors plan to update their software periodically and reexamine different 
user groups on a rotating basis ...") 

It would have been obvious to one skilled in the art at the time of the invention to combine the 
system of Blocher with the SOD analysis software of Lightle because the SOD matrix is an 
efficient tool for ensuring that no single individual inappropriately handles all aspects of a 
transaction or business process and for identifying of any potential conflicts. 



1 1 . With respect to Claim 1 , 

Blocher and Lightle disclose all of the above limitations, Lightle further discloses, 
• the at least one processing component is further configured to compare at least one business 
function incompatibility in the compatibility registry with business functions assigned a set of 
employees in the enterprise; (see at least page 2, paragraph 8: "...the tool contained a matrix 
showing tasks that should not be combined..."; paragraph 9: "...the tool enabled them to test 
user authorizations against SOD conflicts at the basic level of specific transaction 
assignments and to generate a report that listed potential conflicts by user group..."; 
paragraph 10: "...once the software generated it's report, the next step was to analyze and 
confirm whether any of the identified conflicts were, in fact a concern... the internal audit team 
reviewed the list and assessed each item..."; page 3, paragraph 15: "...these built-in SOD 
controls prevent any individual user from being assigned to conflicting transactions... the 
electronic system segregates authorization to initiate a transaction...") 
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• create a report identifying at least one employee in the set of employees that is 
simultaneously assigned to business functions that are identified as incompatible as per the 
at least one business function incompatibility, (see at least page 2, paragraph 9: "...using the 
new software, they were able to generate automated SOD reports.... that listed potential 
conflicts by user group...") 

It would have been obvious to one skilled in the art at the time of the invention to combine the 
system of Blocher with the SOD analysis tool of Lightle because the SOD tool is a cost-effective 
technology that internal auditors could use for identifying conflicting assignments with minimal 
assistance while not slowing down system operations throughout the organization. 

12. With respect to Claim 3, 

Blocher, and Lightle disclose all of the above limitations, Lightle further discloses, 

• the report further includes an identification of the at least one business function 
incompatibility (see at least page 2, paragraph 9: "...using the new software, they were able 
to generate automated SOD reports.... that listed potential conflicts by user group..."; 
paragraph 10: "...once the software generated its report, the next step was to analyze and 
confirm whether any of the identified conflicts were, in fact a concern...") 

It would have been obvious to one skilled in the art at the time of the invention to combine the 
system of Blocher with the SOD analysis tool of Lightle because the automated SOD reports are 
an efficient means for identifying and reporting conflicting assignments expeditiously. 

13. With respect to Claims 8-11, 

Blocher and Lightle disclose all of the above limitations, Blocher further discloses, 

• an employee in the set of employees is assigned to a new business function wherein the at 
least one processing component is further configured to create an alert in response to the 
new business function matching at least one business function incompatibility^ see at least 



Application/Control Number: 10/804,364 Page 9 

Art Unit: 3629 

Figure 6: "...Exception field 152 includes an action field 154 for arranging the set of actions 
(i.e., one or more) to be taken to address an identified risk. For the example above, an 
exemplary action could be to "notify internal auditing." It should be appreciated, however, that 
since the review could be made before, during, or after a business process has actually 
occurred, addressing a risk could mean preventing or correcting a problem. Action execution 
field 156 allows an action entity to be designated for carrying out the set of actions. Similar to 
the above-described test execution field 142 of FIG. 5, the action entity could be an 
individual, group of individuals, or an expert system. Moreover, any quantity of action entities 
could be indicated...") 

• the alert is communicated to an auditor (see at least paragraph 4: "...a possible action to 
address this risk could be to inform corporate auditors..."; paragraph 8: "...In addition, the 
present invention provides a template and method for arranging information pertaining to 
each control point. By using the method and template of the present invention, reviewers, 
auditors, or the like are provided with a complete resource for accurately and efficiently 
performing their duties..."; paragraph 55: "...Once a control point/risk is identified, a set of 
actions could be proposed and/or implemented to address the risk. A possible action for the 
above example could be to notify internal auditing...") 

• the alert includes an identification of the employee assigned to the new business function 

• the alert includes an identification of the at least one business function incompatibility 
matching the new business function (see at least paragraph 55: "...Once the process is 
provided, any risks therein should be identified. Each identified risk represents a control point 
that should be addressed. Preferably, a review is conducted each time a new business 
process is created, or an existing business process is modified. A possible risk with the 
invoice business process could be if the individual approving payment is also authorized to 
sign the check. To identify whether this risk has occurred (or will occur), a set of tests or 
checks is performed on the business process. The set of tests are performed by a test entity 
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(i.e., an individual, group of individuals, or an expert system). An example of a test could be 
to compare the identification of the individual approving payment to the identification of the 
individual signing the check. For example, if employee number "123" of XZY, Inc. approved 
payment of invoice "456" and also signed the check, the risk exists and a control point is 
identified. Once a control point/risk is identified, a set of actions could be proposed and/or 
implemented to address the risk. A possible action for the above example could be to notify 
internal auditing...") 

14. With respect to Claim 12, 

Blocher and Lightle disclose all of the above limitations, Lightle further discloses: 
• at least one processing component is further configured to prevent the assignment of another 
new business function to the employee in response to the new business function matching 
the at least one business function incompatibility, (see at at least page 3, paragraph 15: 
"...these built-in SOD controls prevent any individual user from being assigned to conflicting 
transactions...") 



15. Claim 4 is rejected as being unpatentable over Blocher et al., US Patent Application No US 
2002/0194059 A1, in view of The Internal Auditor, Segregation of duties in ERP, October 2003., 
Vol. 60, Iss. 5, pg. 27, Susan S. Lightle, Cynthia Waller Valrio; herein referred to as "Lightle" in 
further view of Wefers et al., International Publication No WO 2005/055098 A2. 

16. With respect to Claim 4, 

Blocher and Lightle disclose all of the limitations described above, the combination of Blocher and 
Lightle does not distinctly disclose the following limitations, but Wefers however as shown 
discloses, 
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• the at least one processing component is further configured to run a set of workflow-enabled 
applications having a set of functions adapted to implement the set of business 
processes,(see at least Figure 2, paragraph 128: "...a processor may receive instructions 
and data from a read-only memory or a random access memory or both... the processor 
system may execute instructions and one or more memory devices for storing instructions 
and data..."; paragraph 81: "...once the scope and project and the internal controls for are set 
up and/or documented for the management of internal controls, workflows may be scheduled 
and implemented for these internal controls.... users in organization may be assigned roles. 
Each role may have one or more tasks or activities associated with it.... workflows are created 
and scheduled for each user based on their roles. ..workflows that may be provided by 
methods and systems of the present invention include an assessment of control design, 
assessment of control efficiency, assessment of process design, and testing of control 
effectiveness...") 

It would have been obvious to one skilled in the art at the time of the invention to combine the 
system of Blocher and the SOD analysis tool of Lightle with the workflows of Wefers because the 
the workflows are an efficient means for the assessment of an organization's internal controls and 
could also be used to identify remediation plans associated with the controls. 

Blocher, and Lightle disclose all of the limitations described above, Lightle further discloses, 

• such that an assignment of business functions to an employee in the set of employees 
enables the employee to access corresponding functions in the set of functions that 
implemented said business functions, (see at least page 3, paragraph 15: "...an ERP based 
system electronically segregates duties by assigning user authorizations according to the 
types of transactions each user can perform, permitting access only to the authorized 
transactions...") 
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It would have been obvious to one skilled in the art at the time of the invention to combine the 
system of Blocher with the SOD analysis tool of Lightle because the SOD controls would prevent 
any individual user from being assigned to conflicting transactions. 

17. Claim 14 is rejected as being unpatentable over Blocher et al., US Patent Application No US 
2002/0194059 A1 , in view of The Internal Auditor, Segregation of duties in ERP, October 2003., 
Vol. 60, Iss. 5, pg. 27, Susan S. Lightle, Cynthia Waller Valrio; herein referred to as "Lightle" in 
further view of Flaxer etal., US Patent Application Publication No US 2004/0162741 A1. 

18. With respect to Claim 14, 

Blocher and Lightle disclose all of the limitations described above. The combination of Blocher 
and Lightle does not distinctly disclose the following limitations, but Flaxer however as shown 
discloses, 

• at least one business process in the business process library includes a parent business 
function and a child business function, (see at least Figure 2, paragraph 82: "...evolution of 
distributed business processes. The underlying paradigm relies on dynamic composition of 
localized business processes into enterprise wide business processes based on business 
rules. The invention uses a service ontology to model basic concepts, terminologies and 
functionality in different functional domains. As shown in the example in FIG. 1, there is a 
hierarchy of functional domains in the system: each non-root node 115 and 116 represents a 
functional domain while the root 110 represents the whole system. In each domain, there is a 
service ontology 120 and a set of service composition schemas 130 that model business 
processes (i.e. composite services) in the domain. It is noted that service ontologies 120 are 
used to define service composition schemas 130, service description, etc paragraph 83: 
". . .the child node inherits the properties of the parent node. . .") 
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• wherein the child business function inherits the list of incompatible business functions 
associated with the parent business function, (see at least paragraph 83: "...the child node 
inherits the properties of the parent node...") 
It would have been obvious to one skilled in the art at the time of the invention to combine the 
system of Blocher and the SOD analysis software of Lightle with the Product Lifecycle 
Management system of Flaxer it is an efficient tool for ensuring a complete registry of conflicting 
business processes whereby sub-functions are also included in the database. 

Response to Arguments 

19. Applicant's arguments with respect to independent claim13 have been considered but are moot in 
view of the new ground(s) of rejection. 

20. Applicant's arguments with respect to dependent claims 1, 3, 4, 8-12, and 14 have been 
considered but are also moot in view of the new ground(s) of rejection. 

21. Applicant's arguments received on May 5, 2009 have been fully considered but they are not 
persuasive. Applicant's arguments will be addressed herein below in the order in which they 
appear in the response filed May 5, 2009. 

22. With regard to limitations of applicant's amended claim 13 beginning on page 7 of the Remarks, 
Applicant broadly states that "...claim 13 is not rendered obvious by Blocher or Lightle, 
considered individually or in combination..." In response, all of the limitations which Applicant 
disputes as missing in the applied references have been fully addressed by the Examiner as 
either being fully disclosed or obvious in view of the collective teachings of Blocher and Lightle 
based on the logic and sound scientific reasoning of one ordinarily skilled in the art at the time of 
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the invention, as detailed in the remarks and explanations given in the preceding sections of the 
present Office Action, and in the prior Office Action incorporated herein. 



With regard to Claims 4, and 14 on page 10 of the Remarks, Applicant broadly states that "they 
depend from independent claim 13, which is not rendered obvious by Blocher and Lightle ..." . In 
response, all of the limitations which Applicant disputes as missing in the applied reference is fully 
disclosed or obvious in view of the collective teachings of Blocher, Lightle, Wefers, and Flaxer 
and base on the logic of one ordinarily skilled in the art. Blocher discloses a template and 
method for reviewing business process to identify and address risks (control points) wherein the 
set of actions address any identified risks. The database provides for storage of the templates 
which allows reviewers, auditors, or the like to efficiently access control point information and 
accurately perform their duties. Lightle discloses a Segregation of Duties (SOD) software 
analysis tool to ensure that no signle individual inappropriately handles all aspects of a 
transaction or business process. It provides a matrix to show tasks that should not be combined 
based on business concepts and experiences. Wefers discloses workflows as a means for the 
assessment of an organization's internal controls and to identify remediation plans associated 
with the controls. Flaxer describes a Product Lifecycle Management system for ensuring a 
complete registry of conflicting business processes whereby sub-functions are also included in 
the database. 

In addition, The Examiner recognizes that obviousness can only be established by combining or 
modifying the teachings of the prior art to produce the claimed invention where there is some 
teaching, suggestion, or motivation to do so found either in the references themselves or in the 
knowledge generally available to one of ordinary skill in the art. See In re Fine, 837 F.2d 1071,5 
USPQ2d 1596 (Fed. Cir. 1988) and In re Jones, 958 F.2d 347, 21 USPQ2d 1941 (Fed. Cir. 
1992). The rationale to modify or combine the prior art does not have to be expressly stated in 
the prior art; the rationale may be expressly or impliedly contained in the prior art or it may be 
reasoned from knowledge generally available to one of ordinary skill in the art, established 
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scientific principles, or legal precedent established by prior case law. In re Fine, 837 F.2d 1071, 
5USPQ2d 1596 (Fed. Cir. 1988); In re Jones, 958 F.2d 347, 21 USPQ2d 1941 (Fed. Cir. 1992). 
See also In re Eli Lilli & Co., 902 F.2d 943, 14 USPQ2d 1741 (Fed. Cir. 1990) (discussion of 
reliance on legal precedent); In re Nilssen, 851 F.2d 1401, 7USPQ2d 1500 (Fed. Cir. 1988) 
(references do not have to explicitly suggest combining teachings); Ex parte Clapp, 227 USPQ 
972 (Bd. Pat. App & Inter); and Es parte Levengood, 28 USPQ2d 1300 (Bd. Pat. App. & Inter. 
1993) (reliance on logic and sound scientific reasoning). Also in reference to Ex parte 
Levengood, 28 USPQ2d, 1301, the court stated that "Obviousness is a legal conclusion, the 
determination of which is a question of patent law. Motivation for combining the teachings of the 
various references need not to explicitly found in the reference themselves, In re Keller, 642 F.2d 
413, 208USPQ 871 (CCPA 1981). Indeed, the Examiner may provide an explanation based on 
logic and sound scientific reasoning that will support a holding of obviousness. In re Soli, 317 
F.2d 941 137 USPQ 797 (CCPA 1963).". Detailed explanations are given in the preceding 
sections of the present Office Action. 

Conclusion 

23. Applicant's amendment necessitated the new ground(s) of rejection presented in this Office 
Action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP 706.07(a). Applicant is 
reminded of the extension of time policy as set forth in 37CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE MONTHS from 
the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the 
mailing date of this final action and the advisory action is not mailed until after the end of the 
THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the 
date the advisory action is mailed, and any extension fee pursuant to 37 CFR 1.136(a) will be 
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calculated from the mailing date of the advisory action. In no event, however, will the statutory 
period fro reply expire later than SIX MONTHS from the date of this final action. 

24. Any inquiry of a general nature or relating to the status of this application or concerning this 
communication or earlier communications from the Examiner should be directed to Kimberly L. 
Evans whose telephone number is 571.270.3929. The Examiner can normally be reached on 
Monday-Friday, 9:30am-5:00pm. If attempts to reach the examiner by telephone are 
unsuccessful, the Examiner's supervisor, John Weiss can be reached at 571.272.6812. 

25. Information regarding the status of an application may be obtained from the Patent Application 
Information Retrieval (PAIR) system. Status information for published applications may be 
obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR system, 
see http://portal.uspto.gov/external/portal/pair <http://pair-direct.uspto.gov >. Should you have 
questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 
866.217.9197 (toll-free). Any response to this action should be mailed to: Commissioner of 
Patents and Trademarks, P.O. Box 1450, Alexandria, VA 22313-1450 or faxed to 571-273- 
8300. Hand delivered responses should be brought to the United States Patent and Trademark 
Office Customer Service Window: Randolph Building 401 Dulany Street, Alexandria, VA 22314. 

/KIMBERLY EVANS/Examiner, Art Unit 3629 



/JOHN G. WEISS/ 

Supervisory Patent Examiner, Art Unit 3629 



